Redhat 8 + nginx + grav - Failed to start session: session_start(): Failed to read session data: files (path: /var/lib/php/session)

Hello everyone,

I struggled a bit getting Grav working on a Redhat Enterprise Linux 8 system using nginx as the webserver. I am posting this here in case anyone encounters the issue. The error that appears is that PHP throws an exception that it cannot read session data from or write to /var/lib/php/session.

The error message was

Failed to start session: session_start(): Failed to read session data: files (path: /var/lib/php/session)

The problem turned out to be subtle assumption on the part of the installation of php-fpm, which was that it provided a group id of apache for the session folder under /var/lib/php.

To get grav to work, I needed to follow the specific instructions about Permissions in the documentation, including the context change command shown at the bottom of this page under “SElinux-specific advice.”

The assumption made by the installation of php-fpm is that apache is the webserver. So, the group permissions look like this:

ls -l /var/lib/php
total 0
drwxrwx—. 2 root apache 6 Jul 7 2022 opcache
drwxr-xr-x. 2 root root 30 Feb 28 13:10 peclxml
drwxrwx—. 2 root apache 123 Feb 28 13:30 session
drwxrwx—. 2 root apache 6 Jul 7 2022 wsdlcache

So despite the advice not to change permissions of system files in /etc/php-fpm.d/www.conf, I did so anyway and it worked. I also changed the permissions of opcache & wsdlcache simply to match the same pattern:

ls -l /var/lib/php
total 0
drwxrwx—. 2 root nginx 6 Jul 7 2022 opcache
drwxr-xr-x. 2 root root 30 Feb 28 13:10 peclxml
drwxrwx—. 2 root nginx 123 Feb 28 13:30 session
drwxrwx—. 2 root nginx 6 Jul 7 2022 wsdlcache

One could also change the configuration of nginix to run as user and group apache, I suppose.

Thanks to the developers of grav for all their hard work. I’m looking forward to using it now that I have it installed.

Regards,
David

2 Likes

signed up to say thank you

1 Like

I’m glad it helped. Please note that a recent version upgrade of RedHat 8 rewrote the permissions back to gid apache. So I had to repeat the process.

In retrospect, it is probably better to run nginx with its user id set to apache in /etc/nginx/nginx.conf. That way this step will not need to be repeated for significant upgrades.